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Today,  we  are  on  the  verge  of  technological  advances  which  will  redefine  how  we  wage  war  and,  in  many 
cases,  blur  the  current  line  between  economic  competition  and  warfare.  The  technology  area  which  holds 
the  most  promise  as  well  as  the  most  unknown  danger  is  the  world  of  computer  networks — cyberspace. 

Cyberspace  is  a  “place”  in  many  respects.  A  “place”  enables  people  to  meet,  exchange  ideas  and 
information,  conduct  business,  and,  importantly,  compete.  More  than  a  means  of  communication 
comprising  a  meeting  ground  and  information  exchange,  cyberspace  is  a  pathway  for  commerce.  In  the 
future  mankind’s  activities  will  center  more  on  interpreting  or  sorting  data  to  derive  information  and  then 
sharing  that  information  in  useful  ways.  The  overwhelming  majority  of  this  information  will  be  relayed  via 
computer  networks,  and  this  information  will  carry  increasing  value  as  a  commodity.  Already,  companies 
compete  for  market  share  by  advertising  on  the  internet.  Increasingly,  we  may  find  this  competition 
extending  into  disrupting  information  flows  of  competitors.  From  there,  it  is  not  hard  to  imagine  rival 
nations  capitalizing  upon  each  others’  computer  network  vulnerabilities  to  promote  their  own  national 
interests.  Thus  cyberspace  will  become  another  medium  for  human  competition  expressed  as  warfare. 

Warfare  in  cyberspace,  at  least  as  conducted  by  democracies,  needs  to  be  governed  by  laws  of  war  and 
rules  of  engagement  just  as  warfare  in  other  mediums  is.  As  mankind  ventured  into  the  mediums  of 
water  and  air,  first  as  experiments,  then  with  commercial  ventures,  naval  and  aerial  warfare  followed.  Just 
as  the  laws  of  war  evolved  to  support  humane  execution  of  war  on  land,  sea  and  air,  each  with  unique 
rules  of  engagement,  so  must  we  also  discuss  rules  of  engagement  which  will  be  unique  to  cyberspace. 
We  must  reinterpret  our  political  ethics  in  terms  of  our  new  era  and  conditions. 

This  study  will  attempt  to  reinterpret  our  ethics  in  terms  of  our  nations’  capabilities  to  attack  another  in  the 
realm  of  cyberspace.  Except  for  brief  excursions  into  terror  bombing  during  the  world  wars,  the  western 
democracies  sought  to  limit  injury  to  the  combatants  of  the  enemies.  Nevertheless,  these  governments 
have  attacked  their  rivals’  ability  to  conduct  trade  using  methods  from  naval  warfare  to  economic 
sanctions.  Thus  we  have  seldom  considered  an  attack  on  the  livelihood  or  quality  of  life  of  the  rival’s 
citizenry  unlawful.  Arguably,  we  now  have  the  capability  to  plunge  an  entire  nation  into  deep  economic 
depression,  severely  limiting  the  quality  of  life  or  causing  mass  starvation  in  extreme  cases.  Although  past 
wars  have  witnessed  attempts  to  target  the  “will  of  the  people”  as  a  means  of  achieving  political  ends,  can 
a  democracy  undertake  such  a  campaign  knowing  that  the  suffering  of  the  enemy  population  will  be 
shown  on  CNN?  Does  this  new  capability  require  us  to  reexamine  the  blurred  line  between  economic 
competition,  economic  warfare  and  outright  war?  If  so,  how  will  the  western  democracies  construct  their 
laws  of  war  in  light  of  rival  centers  of  gravity  shifting  from  military  forces  or  capitals  to  banking,  stock 
markets  or  the  will  of  the  people?  If  these  become  legitimate  targets,  how  will  we  attack  them,  and  what 
conditions  will  cause  us  to  show  restraint? 
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MORAL  AND  ETHICAL  CONSIDERATIONS  FOR  COMPUTER  NETWORK  ATTACK 
AS  A  MEANS  OF  NATIONAL  POWER  IN  TIME  OF  WAR 


Those  who  really  deserve  praise  are  the  people  who,  while  human  enough  to  enjoy 
power,  nonetheless  pay  more  attention  to  justice  than  they  are  compelled  to  do  by  the 
situation. 

— Thucydides,  Speech  of  the  Athenians’ 

I  have  the  power,  the  capability,  sitting  in  my  home  with  my  computer  and  my  modem — if 
I  only  understood  how  to  do  it — ^wage  war.  That  is  a  very  different  environment  than 
anything  that  we  have  experienced  in  the  past. 

— James  Adams^ 

Today,  we  are  on  the  verge  of  technological  advances  that  will  redefine  how  we  wage  war  and,  in 
many  cases,  blur  the  current  line  between  economic  competition  and  warfare.  The  technology  area 
which  holds  the  most  promise  as  well  as  the  most  unknown  danger  is  the  world  of  computer  networks — 
cyberspace. 

With  the  proliferation  of  computers  and  ever-increasing  computing  power  available  to  nearly  every 
private  citizen  in  developed  countries,  microprocessors  have  changed  the  lives  of  countless  millions  of 
people.  The  ubiquity  of  computing  within  business,  finance,  educational  institutions  and  the  military  has 
raised  concerns  about  the  security  of  both  data  and  tools  upon  which  we  have  become  increasingly 
dependent.®  Many  authors  have  expressed  increasing  concerns  with  our  computer  security  over  the  past 
several  years.  Some  have  speculated  that  an  attack  against  the  United  States  could  disrupt  electricity 
supplies  and  telephone  service,  interfere  with  air  traffic  control,  cause  leaks  or  explosions  at  chemical 
plants  or  refineries,  and  cause  economic  damage  ranging  into  billions  of  dollars.''  Likewise,  other  nations 
and  transnational  groups  may  have  similar  vulnerabilities  the  U.S.  could  exploit.  Therefore,  some  people 
reason  the  United  States  should  develop  its  own  capabilities  in  the  realm  of  computer  network  attack. 

In  many  articles  and  books,  authors  highlight  the  supposed  elegance  of  bringing  an  enemy  to  his 
knees  without  firing  a  shot — instead  rendering  him  defenseless  and  harmless  by  defeating  his  information 
infrastructure  via  surgical  attacks.^  The  weapons  of  computer  network  attack  include  “chipping”^  - 
inserting  malevolent  code  into  hardware  during  manufacturing  -  programming  “back  doors”  to  allow 
external  control  of  the  computer  and  computer  viruses.  On  the  surface,  these  weapons  appear  to  be 
nonlethal  in  nature,  but  may  have  disruptive  or  deadly  higher  order  effects. 

The  United  States  and  other  nations  are  contemplating  the  addition  of  computer  attack  to  their 
arsenals.  During  the  Kosovo  intervention,  the  United  States  attempted  limited  electronic  attacks  on 
Serbian  computers  containing  banking  records  of  Serbian  leaders.^  The  U.S.  is  not  alone,  however.  In 
1995,  the  National  Security  Agency  and  Department  of  Energy  estimated  that  over  120  nations  had  some 
sort  of  computer  attack  capability.^  The  People’s  Republic  of  China  is  studying  numerous  types  of  “dirty 


war” — ^“asymmetric  attack”  in  today’s  military  parlance — ^which  include  using  computer  viruses  to  pitch 
China’s  technologically  advanced  enemies  into  “political  and  economic  crisis.” 

The  potential  for  such  a  crisis  makes  the  application  of  computer  network  attack  (CNA)  a  very 
different  sort  of  combat  power  than  the  kinetic  weapons  it  may  someday  supplement  or  replace.  Like 
kinetic  weapons,  network  attack  can  destroy  both  military  and  civil  targets.  Unlike  most  kinetic  weapons, 
however,  it  can  reach  across  the  world  at  the  speed  of  light  passing  over  many  international  borders 
enroute  to  its  target.  Like  chemical  and  biological  weapons,  cyber  weapons  can  target  large  masses  of 
people  in  both  military  and  civilian  communities.  Unlike  biological  and  chemical  weapons,  they  do  not 
directly  affect  humans.  Thus,  the  cyber  weapons  share  some  similarities  with  weapons  of  yesterday,  yet 
they  occupy  a  completely  new  niche  by  their  very  nature.  Their  uniqueness  requires  well-considered 
policy  for  their  use. 

To  utilize  these  weapons  ethically  and  legally,  commanders  and  staffe  must  weigh  their  use  against 
classes  of  targets  and,  in  some  cases,  against  individual  targets  using  clearly  enunciated  interpretations 
of  the  doctrines  of  discrimination  and  proportionality.  The  dilemma  was  stated  by  a  newspaper  reporter, 
“For  now,  many  sticky  questions  must  be  considered:  When  is  a  cyber  attack  justified,  what  if  it  affects 
civilians  and  is  a  cyber  attack  an  act  of  war?”’° 

DEFINING  INFORMATION  OPERATIONS  AND  COMPUTER  NETWORK  ATTACK 

The  current  joint  military  doctrine  weaves  computer  network  attack  into  a  larger  tapestry  of  several 
more  traditional  military  disciplines,  calling  this  assemblage  Information  Operations  (10).  Defined  as 
“actions  taken  to  affect  adversary  information  and  information  systems  while  defending  one’s  own 
information  and  information  systems,”  10  encompasses  operations  security  (OPSEC),  psychological 
operations  (PSYOP),  military  deception,  electronic  warfare  (EW),  physical  attack,  and  computer  network 
attack  (CNA).''  Most  of  these  disciplines  are  as  old  as  warfare  itself. 

Of  the  disciplines  of  lO,  computer  network  attack  is  the  newest.  While  primarily  a  technical  means, 
successful  CNA  depends  upon  clear  intelligence,  well-defined  intent,  and  clear  understanding  of  the 
primary  and  secondary  effects  of  an  attack  operation.  Thus,  while  highly  technical,  CNA  relies  heavily 
upon  the  artistic  mind  of  its  practitioner.  For  a  skillful  practitioner,  CNA  becomes  an  enabler  for  deception 
and  psychological  operations. 

There  are  several  technical  means  of  executing  a  computer  network  attack.  The  most 
straightforward  is  to  physically  destroy  the  computers  or  critical  network  nodes.  An  example  would  be  to 
attack  the  computer’s  building  with  precision  munitions  to  disrupt  the  computer’s  function  or  destroy  it 
altogether.  There  are  electronically  intrusive  means  as  well.  First,  the  friendly  force  can  steal  an 
adversary’s  data,  enabling  better  decisions  for  friendly  force  employment  or  corrupt  his  databases, 
“helping”  the  enemy  to  reach  poor  decisions.  Another  means  of  attack  is  deny  access  to  networks  or 
force  them  to  a  halt  using  viruses.'^  This  forces  the  enemy  to  use  less  efficient  communications  and 
processing  means,  slowing  his  logistics  and  decision  cycles.  Finally,  attackers  may  surreptitiously 
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reprogram  enemy  computers  to  disrupt  the  processes  they  control.  An  example  is  denying  electricity  to 
an  area  by  reprogramming  the  computers  controlling  distribution  within  the  power  grid. 

The  far-reaching  potential  of  CNA  requires  thinking  about  its  moral  and  ethical  consequences. 
There  has  long  been  debate  about  the  nature  of  nuclear,  chemical  and  biological  weapons — ^whether  they 
differ  in  kind  from  kinetic  weapons  or  whether  they  merely  differ  in  the  magnitude  of  their  effects. 

Similarly,  if  CNA  varies  only  in  degree,  existing  rules  are  sufficient  to  examine  the  morality  of  its  use. 
Otherwise,  mankind  should  derive  new  rules  or  must  renounce  its  use.*^  At  first  examination,  its  use 
against  military  targets  to  disrupt  clearly  military  activities  appears  legal  and  ethical.  However,  the  legal 
and  ethical  issues  become  more  complex  as  it  targets  civil  infrastructure  or  uses  attack  means  that 
replicate  themselves  beyond  the  targeted  computer  or  network. 

THE  NATURE  OF  COMPUTER  NETWORK  ATTACK 

At  first  glance,  the  concept  of  Computer  Network  Attack  appears  a  dream  come  true  for  a 
technologically  advanced  nation.  CNA  presents  an  opportunity  for  the  government  to  exercise  many  of 
the  elements  of  national  power  without  endangering  its  forces  and,  if  it  can  do  so  anonymously,  without 
jeopardizing  its  honor.  Many  would  not  even  consider  CNA  as  a  weapon  at  all.  Those  who  do,  consider 
it  nonlethal,  thus  unlikely  to  produce  pictures  of  dead  or  maimed  people  in  the  media.  Similarly,  first  order 
effects  of  an  electronic  attack  will  not  produce  physical  destruction,  except  perhaps  to  the  computer  itself. 
Again,  users  would  anticipate  fewer  lucrative  media  pictures  or  stories.  Thus,  considering  first  order 
effects  only,  CNA  appears  to  be  an  ideal  means  of  exercising  national  power. 

Considering  only  first  order  effects,  the  nature  of  CNA  places  it  in  a  unique  niche  in  a  nation’s 
arsenal.  The  effects  may  be  of  long  or  short  duration-mere  harassment  or  society-wrecking 
infrastructure  shutdown.  Attacks  may  affect  either  very  limited  or  nearly  unlimited  populations,  including 
whole  classes  of  noncombatants.  The  attacker  can  be  very  difficult  to  trace,  since  an  attack  may  pass 
through  mainy  different  computers  enroute  to  the  target.  This  feature  means  that  attackers  may  navigate 
numerous  “third  party”  nations  which  may  or  may  not  approve  of  the  attack  or  the  means  used.  Even  if 
the  target  nation  locates  the  source  of  the  attack,  it  will  have  difficulty  distinguishing  whether  it  has  been 
attacked  by  a  sophisticated  private  hacker,  a  corporate  entity,  or  another  nation.  Finally,  the  worldwide 
reach  of  a  network  attack  means  that  no  computer  or  network  is  in  a  sanctuary  unless  it  is  completely 
isolated  from  outside  networks  and  the  telephone  system. 

The  unique  nature  of  CNA  has  several  implications  for  practitioners  and  policymakers.  First,  the 
potentially  anonymous  nature  may  result  in  aggressor  nations  using  CNA  widely  to  accomplish  a  number 
of  goals  in  the  political  and  economic  arenas.  Such  use  will  bring  to  question  which  sorts  of  policy  should 
govern  the  use  of  CNA — ^wartime  rules  of  engagement  or  civil  law.  As  a  political  or  economic  tool,  CNA 
may  aim  to  stress  the  population  at  large;  who  in  turn  affect  policy  makers  of  the  attacked  states.  In  this 
way,  CNA  could  take  on  the  nature  of  economic  sanctions,  which  potentially  cause  widespread  suffering 
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of  innocents  as  a  means  to  achieve  political  influence.'^  Absent  legal  precedents  to  govern  the  use  of 
technologies  such  as  CNA,  we  must  turn  to  the  just  war  tradition  to  examine  the  ethics  of  its  use. 

THE  CONCEPT  OF  JUS  IN  BELLO 

Mankind  has  attempted  to  regulate  his  conduct  of  warfare  since  earliest  history.  For  example,  Sun 
Tzu,  the  5**'  Century  B.C.  Chinese  military  philosopher  wrote,  “treat  the  captives  well,  and  care  for 
them. ..Generally  in  war  the  best  policy  is  to  take  a  state  intact;  to  ruin  it  is  inferior  to  this.”*^  About  a 
century  later,  Hindu  writings  espouse  humanitarian  rules  including  certain  prohibitions  on  poisoned 
weapons  and  describe  noncombatant  status.*^  The  point  of  these  examples  is  twofold.  First,  throughout 
the  history  of  organized  warfare,  rules  existed  to  lessen  its  cruelty  by  imposing  regulations  on  its 
execution.  Secondly,  the  cultural  and  technological  contexts  determine  much  about  the  regulations. 

Thus,  the  synthesis  of  over  two  thousand  years  of  experience  provides  the  basis  for  today’s  Just  war 
theory. 

The  concept  of  jus  in  bello  encompasses  two  principles,  discrimination  and  proportionality.  As 
noted  above,  through  most  of  recorded  history,  the  concept  of  “discriminating”  between  the  noncombatant 
and  the  warrior  was  central  to  the  “proper”  exercise  of  force.  Likewise,  the  ancients  sought  to  decrease 
the  suffering  inflicted  upon  the  enemy  by  encouraging  battle  with  proportional  means.  Therefore,  defining 
these  principles  for  the  sake  of  analyzing  CNA  is  in  order. 

Discrimination  is  simply  the  principle  recognizing  the  difference  in  treatment  accorded  the  warrior 
and  the  innocent  bystander.  Combatants  are  legal  targets  for  the  application  of  force  and  assume  the  risk 
of  their  avocation  since  they  are  present  upon  the  battlefield  by  their  own  will.  Combatants  make 
themselves  recognizable  by  means  of  a  uniform  or  carrying  arms  openly.  As  combatants,  they  legally 
and  properly  use  force  to  subdue  their  enemy.  Noncombatants,  on  the  other  hand,  are  not  proper  targets 
for  the  application  of  military  force  and  may  not  take  part  in  battle  unless  they  assume  the  role  of 
combatants  by  taking  up  arms.  Though  many  notable  exceptions  exist,  armies  have  generally  attempted 
to  discriminate  between  these  two  classes  of  individuals. 

For  the  purposes  of  this  analysis,  discrimination  is  the  recognition  of  noncombatants’  immunity  from 
deliberate  and  direct  attack  against  their  person  or  possessions.  Simply  put,  attacking  those  carrying 
arms,  wearing  uniforms,  or  engaging  in  the  war  activities  normally  associated  with  combatants  is  a  proper 
(legal)  attack.  Discrimination  applies  both  to  the  aim  of  the  weapon— whether  the  intended  target  is  a 
proper  one;  and  to  the  inherent  characteristics  of  the  weapon  itself— whether  it  is  likely  to  hit  the  target. 
Obviously,  a  rifle  bullet  discriminates  more  than  a  nuclear  weapon. 

Sometimes  legitimate  military  operations  affect  noncombatants  by  accident.  Traditional  thought 
recognizes  this  possibility.  If  there  is  a  danger  of  noncombatant  harm,  the  attacker  may  prosecute  the 
target  only  if  the  “good”  to  be  achieved  by  the  attack  outweighs  the  foreseeable  harm  that  may  result. 
Thus,  a  commander  is  not  bound  to  forego  a  particularly  valuable  target  because  there  is  a  remote 
chance  of  noncombatant  injury  or  death.  Rather  he  is  bound  to  consider  the  value  of  the  target,  the 
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likelihood  of  collateral  damage,  the  extent  of  the  damage  or  injury  and  whether  such  damage  or  injury  is 
reversible.  This  concept,  referred  to  by  the  theorists  as  the  concept  of  double  effect,  leads  to  discussion 
of  the  concept  of  proportionality. 

Proportionality  refers  to  the  level  and  extent  offeree  used  by  combatants  in  the  discharge  of  their 
duties.  It  is  important  to  note  that  proportionality  applies  to  the  effects  of  the  weapons  on  both 
noncombatants  and  combatants  alike.  In  the  case  of  the  noncombatant,  we  return  to  the  concept  of 
double  effect.  Combatants  may  not  directly  attack  the  noncombatant’s  life  and  property,  although  legal 
and  moral  attacks  directed  against  proper  targets  may  affect  them.  The  commander  making  the  attack  is 
bound  to  use  the  least  amount  offeree  and  the  most  discriminating  weapons  to  achieve  his  needed  target 
effect.  This  subjects  the  noncombatants  and  their  property  to  the  least  chance  and  least  amount  of 
destruction  commensurate  with  the  attacker’s  mission.  Applying  proportionality  to  the  case  of  the 
combatant,  the  attacker  is  bound  to  use  only  weapons  that  do  not  unnecessarily  prolong  suffering  after  a 
combatant  is  injured.  The  attacker  is  likewise  bound  to  use  the  least  force  that  achieves  the  mission.  In 
practice,  this  concept  makes  an  expanding  bullet  an  improper  weapon,  because  of  its  tendency  to  cause 
great  internal  injuries  and  higher  death  rates  than  jacketed  bullets.  Further,  sustained  and  violent  attacks 
upon  a  place  beyond  all  possibility  of  survival  for  the  defenders  would  be  disproportionate  violence. 

For  the  purposes  of  this  analysis,  proportionality  is  the  concept  which  commanders  use  to  temper 
the  violence  used  in  their  attacks.  Proportionality  weighs  the  military  goal  and  the  strength  of  the  enemy 
force  against  the  likelihood  of  collateral  damage/injuries  and  suffering  of  the  enemy  combatants.  The 
result  of  the  balance  determines  the  weapons  choices,  duration  and  finally  moral  character  of  the  attack. 

METHOD  OF  ANALYSIS 

This  paper  examines  Computer  Network  Attack  in  terms  of  discrimination  and  proportionality.  It 
attempts  a  holistic  approach,  considering  not  only  effects  of  the  “munitions”  themselves,  but  also  higher 
order  effects  of  the  attack.  Three  target  cases  will  be  examined:  1)  Attack  on  a  military  command  and 
control  network,  2)  Attack  on  an  electrical  utility  system,  and  3)  Attack  on  an  adversary’s  banking  system. 
In  each  case,  discrimination  and  proportionality  determine  the  character  and  propriety  of  the  attack. 

These  targeting  scenarios  are  germane  to  the  question  of  computer  network  attack  for  three 
reasons.  First,  these  are  plausible  and  likely  scenarios  examined  in  a  number  of  articles  and  books. 
Second,  these  represent  three  of  the  four  principal  categories  of  national  power — military,  political,  and 
economic.  Finally,  these  examine  the  effect  and  character  of  attack  on  three  distinct  centers  of  gravity  of 
an  adversary:  the  military,  the  will  of  the  people  (as  reached  through  disruption  of  their  access  to  electrical 
power)  and  the  adversary’s  economy. 

ANALYSIS  OF  ATTACK  ON  MILITARY  COMPUTER  NETWORKS  (C2W) 

The  attack  of  a  military  computer  network  presents  unique  challenges  as  well  as  unique  potential 
benefits  for  the  attacker.  Attacks  in  this  realm  fall  under  the  category  of  Command  and  Control  Warfare 
(C2W),  a  category  formalized  in  service  and  joint  doctrine.  Joint  doctrine  defines  C2W  as  measures 
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taken  to  “  prevent  effective  command  and  control  of  adversary  forces  by  denying  information,  influencing, 
degrading,  or  destroying  adversary  C2  systems.”  Thus,  C2W  is  not  a  new  idea.  For  example,  ground 
forces  have  made  it  a  point  to  locate  and  destroy  command  centers  with  conventional  fires  since  the 
advent  of  radio  direction  finding  equipment.  Military  forces  have  long  practiced  radio  frequency  jamming 
and  imitative  deception  in  adversary  radio  networks  as  an  accepted  means  in  war.  Such  measures 
increase  the  uncertainty  of  war  for  the  adversary  and  slow  his  decision  cycle.  In  the  near  future,  weapons 
such  as  High  Energy  Radio  Frequency  (HERF)  generators  may  join  viruses  and  other  software  means  as 
weapons  for  CNA. 

Against  command  and  control  systems,  the  majority  of  attacks  will  be  proper  or  moral  attacks. 
Such  targets  at  the  tactical  level  will  be  single  use  (i.e.  military  only)  systems  having  neither  connections 
to  civilian  networks  nor  civilian  functions.  Because  of  this  relative  isolation,  the  attacker  foresees  no 
effects  off  the  battlefield.  Therefore,  attacking  such  a  system  meets  the  requirement  of  discrimination. 
Because  no  physical  destruction  is  involved,  (except  perhaps  to  the  computer  network  hardware  itself), 
proportionality  is  not  an  issue  vis-a-vis  first  order  effects.  Foreseeable  higher  order  effects  center  on  the 
ability  of  the  attacked  to  control  his  forces— exactly  the  effects  desired.  These  may  include  loss  of  critical 
coordination  capability  and  early  defeat  of  the  adversary  with  less  loss  of  life.  There  is  one  caveat  to  the 
apparently  moral  targeting  in  C2W,  however.  It  may  be  possible  through  imitative  deception  to  commit 
perfidious  acts.  An  example  would  be  to  broadcast  an  “all-clear”  Just  prior  to  a  missile  barrage  in  hopes  of 
catching  more  people  in  the  open  and  increasing  casualties.  Acts  such  as  this  increase  the  casualties 
and  suffering  of  the  enemy  soldiers  and  would  be  improper  using  the  tenants  of  jus  in  beilo.  In  summary, 
C2W  appears  to  be  a  ripe  area  for  computer  network  attacks  due  largely  to  the  discrete  and  isolated 
nature  of  the  potential  targets. 

ANALYSIS  OF  ATTACKING  FINANCIAL  TARGETS 

Like  military  command  and  control  computers,  computer  networks  that  run  a  nation’s  economy 
present  tempting  targets  for  a  well-developed  cyber  attack.  The  Clinton  administration  recognized  the 
debilitating  possibilities  of  disrupting  a  stock  exchange  or  central  bank  in  Presidential  Decision  Directive 
63.  This  document  directed  study  of  methods  and  policies  to  protect  “critical  infrastructure”  including 
economic  targets.  Finance  in  general  is  very  sensitive  to  perception  and  hence,  to  misinformation.  For 
example,  the  prices  on  a  stock  exchange  and  the  values  of  the  underlying  currency  fluctuate  with 
confidence  in  the  currency  and  banking  system.  This  sensitivity  makes  a  financial  system  an  ideal  target 
for  attacks  that  undermine  that  confidence.  Draining  a  nation’s  banks  or  rendering  its  currency  unstable 
produces  second  and  third  order  effects  through  all  segments  of  the  targeted  society.  A  loss  in 
confidence  in  the  national  bank  or  the  currency  itself  reduces  the  value  of  the  currency  on  the 
international  exchange,  making  imported  goods  more  expensive  for  the  nation’s  consumers  (or  military). 
Rampant  inflation  and  high  unemployment  may  result,  bringing  disruption  and  at  least  minor  suffering  to 
innocent  and  combatant  alike.  Thus,  few  would  consider  an  attack  on  a  national  finance  system 
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discriminating.  However,  could  such  an  attack  have  sufficient  military  worth  to  be  considered  a  proper 
attack? 

The  World  War  II  attempts  to  disrupt  the  German  economy  through  strategic  bombing  provide  an 
example  to  consider  the  justification  of  targeting  financial  operations.  From  1943  onward,  the  Allied 
strategy  attempted  to  isolate  essential  industries  to  bring  the  German  economy  to  a  halt  and  force 
capitulation.  Planning  for  a  campaign  of  economic  paralysis  had  begun  in  Great  Britain  as  early  as  1937. 

The  plan  called  for  attacks  centered  on  manufacturing  resources,  the  aircraft  industry,  and 
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communications  networks.  During  the  period  after  the  attacks  commenced,  analysts  found  that  the 
production  of  aircraft  actually  increased  and  the  psyche  of  the  German  people,  far  from  crumbling, 
allowed  continued  operation  of  the  critical  industries.^*  Those  not  driven  from  their  homes  or  killed 
suffered  from  the  eventual  collapse  of  the  normal  economy.  Meanwhile  combat  operations  continued. 
This  evidence  indicates  that  a  population  will  endure  great  suffering  under  a  government  at  war  allowing 
that  government’s  war  effort  to  continue  and  even  tolerate  diversion  of  assets  from  civilian  relief  to  that 
war  effort.  Disruption  of  the  economy  failed  to  disrupt  the  military  potential  of  the  economy  as  much  as 
the  complete  physical  destruction  did  in  the  last  months  of  the  war.  The  conclusion  is  that  economic 
attacks  cause  widespread  civilian  suffering  long  before  any  noticeable  effect  occurs  on  the  military 
potential  of  a  warring  nation.  Thus,  such  attacks,  far  from  having  a  proportional  effect  on  military 
operations  have  quite  the  opposite  (disproportional)  effect. 

ANALYSIS  OF  ATTACKS  ON  NATIONAL  ELECTRIC  POWER  GRIDS 

Since  the  advent  of  strategic  attacks,  the  United  States  has  shown  much  interest  in  the  possibility 
of  denying  electricity  as  a  means  of  disrupting  war  industry,  impeding  military  operations  and  undermining 
the  will  of  the  people.  Recognizing  this,  Nazi  Germany  housed  some  generating  facilities  in  buildings  that 
looked  like  churches.^^  During  the  Gulf  War  of  1991,  the  United  States-led  coalition  devastated  Iraq’s 
public  power  grid.^^  “Proponents  [of  attacking  electrical  utilities]  assert  that  attacking  electricity  results  in 
particularly  damaging  ‘second  order’  impacts  on  civilian  morale,  political  leadership,  military  forces  and 
materiel  production" 

Power  systems  components  fall  into  four  categories: 

1)  Generation  equipment  which  is  centralized,  capital  intensive  and  difficult  to  repair. 

2)  Control  systems  that  are  less  centralized,  but  which  are  computerized  and  thus  theoretically 
vulnerable  to  a  computer  network  attack. 

3)  Transmission  systems  which  are  distributed  and  present  obvious,  but  linear,  sparse  targets. 

4)  Distribution  systems  serving  localities  or  specific  industrial  plants,  which  are  highly  distributed. 

In  general,  targeting  only  the  control  system  disables  the  entire  system.^^ 

Since  a  control  system  is  the  portion  of  the  electrical  grid  most  vulnerable  to  CNA  and  since  it 
disrupts  the  transmission  and  distribution  systems  serving  all  consumers,  such  an  attack  is  indiscriminate 
except  in  one  isolated  case.  Were  it  possible  to  disrupt  only  the  electricity  to  those  targets  which  are 
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proper  for  iron  bombs  (e.g.  military  facilities  and  defense  industry  targets  making  only  war  materiel),  then, 
and  only  then  is  such  an  attack  discriminate.  Until  such  a  capability  exists,  one  must  assume  that  an 
attack  on  electrical  power  fecilities  is  an  attack  on  noncombatants,  as  well  as  fecilities  such  as  hospitals, 
specifically  excluded  from  attack  by  numerous  treaties. 

The  widespread  effects  of  electrical  grid  attacks  are  so  devastating  to  a  modern  society  that  they 
are  neither  humane  nor  proportional  to  the  military  effect  achieved.  Iraq’s  experience  after  the  Gulf  War 
is  an  example.  Neither  water  treatment  plants  nor  sewage  treatment  plants  were  operational  due  to  the 
long-term  electricity  outages.  These  combined  to  produce  a  major  health  crisis.  During  the  year  after  the 
Gulf  War,  some  estimates  linked  as  many  as  70,000  to  90,000  Iraqi  deaths  to  the  higher  orders  effects  of 
life  without  electricity.^^  In  Iraq,  the  outages  were  long  term  in  nature  because,  the  large,  obvious 
generator  halls  were  the  favorite  target  of  allied  airmen,  and  these  are  more  time  consuming  and 
expensive  to  repair  than  distribution  yards. The  efficacy  of  these  attacks  has  been  called  to  question 
because  many,  if  not  most,  military  targets  have  backup  power  from  dedicated  generators,  making  them 
independent  from  the  public  power  utilities.  Thus,  evidence  from  past  wars  suggests  that  air  attack  of 
electricity  produces  only  very  limited  effect  on  the  outcome  of  the  conflict  In  such  a  scenario  the 
military  advantage  would  hardly  outweigh  the  human  impacts  such  as  reduced  hospital  capacity, 
diminished  agricultural  capacity,  and  reduced  medical  refrigeration  capability.  Indeed,  “customary  law 
protects  foodstuffs,  crops,  and  medicines  during  time  of  war.  The  means  of  attacking  the  political 
stability  of  an  enemy  via  electrical  utility  attacks  clearly  come  at  the  expense  of  the  civilian  populations 
and  thus  bear  no  resemblance  to  discriminate  attacks. 

What  if  the  attacker  is  sophisticated  enough  to  temporarily  interrupt  power,  or  can  turn  it  off  at 
random  times  throughout  the  day?  In  these  cases  too,  the  military  advantage  must  outweigh  civilian 
suffering.  In  some  societies,  power  disruptions  are  a  way  of  life.  When  the  lights  go  out,  life  continues. 
Even  in  southern  California,  sources  say  temporary  interruptions,  though  disruptive,  are  not  damaging. 
Citing  widespread  power  outages  in  1996,  the  Los  Angeles  times  concluded,  “people  are  more  adaptable 
than  anyone  thought.  Critical  power  users  had  backup  power  supplies  to  get  them  through  short-term 
outages  while  maintaining  essential  emergency  services. Although  a  population  may  be  resilient  to 
short  term  power  outages,  the  military  may  be  even  more  resilient  due  to  backup  generation  capability  as 
previously  noted.  Careful  consideration  to  inflicting  temporary  outages  on  a  case  by  case  basis  is  clearly 
in  order. 

ETHICAL  IMPLICATIONS  OF  COMPUTER  NETWORK  ATTACK 

Central  to  the  argument  is  whether  CNA  is  use  of  force  at  all.  From  the  foregoing,  one  may  argue 
that  CNA  is  not  force  at  all  since  there  is  little  or  no  direct  physical  damage  or  suffering.  As  one  current 
writer  points  out,  it  is  to  the  advantage  of  the  United  States  if  CNA  is  not  labeled  as  “force  because  there 
results  much  more  latitude  in  its  use.^*  Others  take  a  differing  view,  stating  that  its  widespread  collateral 
effects  suggest  it  borders  on  a  weapon  of  mass  destruction,  like  chemical  or  biological  weapons.  To 
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attempt  a  rational  adjudication  of  these  widely  divergent  opinions,  let  us  start  by  defining  a  weapon.  A 
weapon  is  a  tool  that  has  utility  in  causing  bodily  harm  or  death  to  a  human  being  or  in  damaging  or 
destroying  property.  Defined  as  such,  a  rifle  is  a  weapon,  but  so  is  a  seemingly  benign  item  such  as 
broomstick,  particularly  when  wielded  as  a  club.  Similarly,  a  computer  used  to  cause  damage  or  bodily 
harm  is  also  a  weapon.  To  use  these  analogies  further,  force  is  the  use  of  weapons  to  cause  bodily 
harm,  death,  or  destruction  of  property.  Thus,  if  a  soldier  uses  a  computer  to  create  harm  or  damage,  or 
to  do  things  that  result  in  harm  or  damage  as  a  foreseeable  consequence,  then  a  computer  is  both  a 
weapon  and  instrument  of  force.  It  important  to  note  that  the  harmful  consequences  are  those  which  are 
foreseeable,  not  merely  those  which  stem  directly  from  the  use  of  force.  The  only  conclusion,  then,  is  that 
a  computer  used  in  a  manner  that  may  cause  foreseeable  injury  or  destruction,  is  a  weapon  and  such  use 
constitutes  force.  Like  any  other  weapon,  the  effects  determine  whether  the  computer  is  a  weapon  as 
well  as  determine  whether  it  is  a  legitimate  one.  Treaties  outlawed  some  weapons,  such  as  barbed 
spears  and  expanding  bullets,  because  they  had  features  that  only  increased  the  suffering  of  the  warriors 
without  an  increase  in  their  military  effectiveness.  Today,  the  United  States  limits  its  use  of  non-guided 
gravity  bombs  to  those  locations  where  collateral  damage  is  unlikely.  Thus,  restrictions  on  weapons  stem 
from  the  amount  of  suffering  produced  as  well  as  to  whether  they  have  sufficient  accuracy  in  a  given 
situation. 

The  direct  results  of  a  discriminate  CNA  on  combatants  will  not  inflict  more  suffering.  Losing 
command  and  control  of  forces  may  increase  casualties  locally,  but  one  expects  an  overall  military 
advantage  leading  to  quicker  defeat  of  the  adversary  and  fewer  casualties  in  the  end.  Except  in  the  case 
of  feigned  surrender,  the  case  of  directly  targeting  computers  affecting  the  care  of  wounded  or  other  acts 
of  perfidy  as  noted  earlier,  the  incidence  of  combatant  suffering  will  not  increase.  That  said,  could  CNA 
be  considered  discriminate? 

The  discriminate  nature  of  CNA  depends  in  large  measure  on  the  target,  its  connectivity,  and  the 
method  of  attack.  From  the  above  analysis,  attacks  on  civilian  electric  infrastructures  are  indiscriminate 
due  to  the  foreseeable  suffering  of  the  affected  populations.  The  target’s  external  connections  affects 
discrimination  because  the  greater  the  connectivity  (defined  as  both  amount  of  external  communications 
as  well  as  number  of  potential  or  habitual  connections  the  machine  uses)  the  more  likely  the  attack  will 
reach  unintended  targets.  Finally,  the  method  of  attack  affects  the  discrimination  of  the  attack.  A  simple 
denial  of  service  attack  on  an  email  server  is  likely  temporary  and  only  inconvenient  to  those  affected.  A 
pernicious  and  self-replicating  virus  implanted  to  replicate  swiftly  through  both  civilian  and  military 
networks  is  indiscriminate  indeed.  In  sum,  like  the  gravity  bomb,  CNA  is  not  inherently  indiscriminate  by 
nature.  Only  indiscriminate  use  renders  it  so. 

IMPLICATIONS  OF  NONLETHALITY 

Though  regulated  in  a  number  of  treaties,  nonlethal  weapons  are  not,  by  nature  either  illegal  or 
immoral.  Returning  momentarily  to  the  analysis  of  the  computer  as  a  weapon,  we  see  that  the  effects  of 
a  weapon  determine  its  nature,  not  the  weapon  itself.  Nonlethal  weapons  are  legal  with  respect  to  jus  in 
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bello  if  the  effects  of  the  weapon  are  not  long  term,  debilitating  or  irreversible.  Conversely,  attacks  with 
permanent  collateral  effects  are  illegal.^^  Nevertheless,  the  above  argument  showed  that  even  nonlethal 
weapons  may  cause  unintended,  nevertheless  foreseeable  lethal  effects.  Even  absent  from  these  higher 
order  effects,  there  are  several  implications  that  govern  the  consideration  to  employ  nonlethal  weapons  in 
general  and  CNA  in  particular. 

The  first  of  these  considerations  deals  with  the  potential  for  increased  use  of  nonlethal  weapons.  If 
the  political  cost  of  an  attack  is  less  with  a  nonlethal  (or  easily  denied)  attack,  policymakers  may  use  such 
means  more  frequently,  and  sometimes  without  considering  the  ethical  consequences.  Preemptive 
strikes  might  become  more  politically  palatable,  thus  increasing  the  chances  for  intervention  without 
thorough  debate  of  the  consequences.^"*  Employing  CNA  may  blur  the  distinction  between  peace  and 
war,  as  some  in  the  media  have  suggested.^^  Accordingly,  lacking  the  “protective”  rubric  of  the  just  war 
convention,  CNA,  like  other  interventions,  boil  down  to  simple  criminal  intrusions  or  acts  of  terrorism. 

CONCLUSIONS 

Examining  CNA  leads  to  four  major  conclusions.  These  suggest  a  “way  ahead”  for  those 
concerned  with  its  employment  and  its  policy.  These  are: 

1 )  CNA  is  an  act  of  force. 

2)  CNA  is  not,  by  itself,  morally  wrong.  It  moral  implication  derives  from  its  context,  particularly  the 
method  of  attack  and  its  target. 

3)  While  parallels  exist  with  both  conventional  weapons  and  weapons  of  mass  destruction  (WMD), 
CNA  occupies  a  unique  niche  as  an  Electronic  Means  of  Mass  Disruption  (EMMD). 

4)  There  is  a  need  for  new  conventions  of  international  law  to  deal  with  EMMD. 

First,  CNA  is  clearly  an  act  of  force.  The  examples  of  attacks  on  the  relatively  isolated  military 
command  system  and  the  attack  on  the  electrical  power  grid  illustrate  this  assertion.  In  both  cases, 
physical  destruction  and  bodily  harm  are  foreseeable  results.  Whether  employing  CNA  at  the  operational 
or  strategic  levels,  combatants  must  consider  their  actions  as  carefully  as  if  they  were  employing  a  cruise 
missile. 

Secondly,  the  context  of  the  computer  attack  determines  its  moral  or  ethical  quality.  The  weapon 
itself  is  morally  neutral.  The  three-step  test  used  by  U.S.  Navy  Judge  Advocates  in  evaluating  the  legality 
(morality)  of  nonlethal  weapons  demonstrates  this.  These  are:  “1)  Would  the  weapon  cause  suffering 
that  is  needless,  superfluous  or  disproportionate  to  military  advantage?  2)  Can  it  be  controlled  to  strike 
only  a  lawful  target  and  be  discriminate?  3)  Do  rules  or  laws  exist  that  prohibit  its  use?”^^  When  applied 
to  computer  network  attacks,  clearly  the  context  rather  than  the  weapon  determine  the  answers  to  these 
questions.  Importantly,  depending  upon  that  context,  the  answer  to  all  three  questions  may  be  “no.” 
Accordingly,  CNA  is  morally  neutral. 

Third,  the  effects  of  a  CNA  are  potentially  so  varied  with  respect  to  bodily  harm,  permanence,  and 
extent  that  there  are  no  parallels  in  conventional  weapons  or  WMD.  They  are  “nonlethal,”  yet  their  higher 
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order  effects  may  potentially  cause  widespread  suffering  and  even  deaths.  The  duration  of  their  effects 
may  be  transient  and  have  only  nuisance  effect.  Conversely,  they  are  potentially  as  permanent  as  that 
expected  from  explosive  weapons.  If  a  WMD  is  defined  as  a  weapon  that  has  widespread  effects  from  a 
relatively  small  weapon,  then  a  self-replicating  virus  is  a  WMD.  However,  if  one  requires  those  effects  to 
include  bodily  harm,  then  an  entirely  new  debate  must  ensue,  depending  upon  the  targets  and  the  effects 
of  the  virus.  Because  they  defy  categorization,  CNA  must  be  considered  as  Electronic  Means  of  Mass 
Disruption  (EMMD) 

Finally,  because  of  the  above  conclusion,  nations  must  undertake  continued  dialogue  to  regulate 
both  computer  crime  and  computer  warfare,  and  to  differentiate  between  the  two.  Such  dialogue  should 
advance  on  two  fronts:  First,  what  target  effects  should  be  outlawed  because  they  represent  suffering  of 
noncombatants?  (Attack  on  electric  power  grids  comes  immediately  to  mind)  Second,  what  targets 
should  be  outlawed  because  the  effects  are  unknown,  unpredictable,  but  foreseeabiy  will  result  in 
suffering?  Perhaps,  as  some  have  suggested,  mankind  must  redefine  its  definition  of  “hostile  act,”^’  and 
even  attempt  a  redefinition  of  war  itself. 

PROPOSED  COMPUTER  NETWORK  ATTACK  POLICIES  FOR  THE  UNITED  STATES 

The  main  points  of  a  national  computer  network  attack  policy  must  serve  both  the  national  interests 
of  the  United  States  as  well  as  ethical  considerations.  The  mainstays  of  such  a  policy  are  Deterrence, 
and  Right  of  First  Use.  For  use  within  the  military,  considerations  of  jus  in  bello  are  required  in 
operational  concepts  and  joint  doctrine. 

To  promote  deterrence,  national  policy  must  be  flexible  enough  to  allow  the  United  States  to 
respond  to  computer  attacks  by  criminals  working  for  monetary  gain,  terrorists  striving  for  political  gain 
and  nation-states  conducting  information  warfare.  Sufficient  technology  overmatch  to  determine  the 
source  of  attacks,  and  intelligence  collection  capabilities  robust  enough  to  determine  the  actors  must  back 
up  this  policy.  Like  many  terrorist  or  criminal  acts  today,  attacks  will  be  difficult  to  trace,  and  perpetrators 
will  be  difficult  to  bring  to  justice  unless  international  cooperation  improves  with  increasing  concern  about 
the  computer  attack  events.  In  the  case  of  nation-state  actors,  the  United  States  must  clearly  state  its 
position  concerning  retaliation.  In  practice,  retaliation  may  be  actions  in  kind,  or  conventional  retaliation, 
marked  by  a  consideration  of  consequences  proportional  to  the  original  attack.  Only  by  clearly  stating 
these  policies  can  the  United  States  justify  its  retaliation.  Thus,  a  clearly  stated  policy  is  key  to 
deterrence. 

The  United  States  should  also  enunciate  a  policy  preserving  the  right  of  first  use  of  computer 
attacks.  In  addition  to  stating  that  such  weapons  are  part  of  the  U.S.  arsenal  in  wartime,  the  policy  should 
include  the  considerations  for  their  use  and  these  considerations  must  rest  firmly  on  jus  in  bello.  Outside 
of  use  in  wartime,  such  a  policy  would  require  a  presidential  “finding”  and  congressional  approval  for  CNA 
use  in  national  security  covert  and  clandestine  operations.  Clearly  stating  such  a  policy  may  quell 
debate  following  a  first  use.  More  importantly,  it  may  convince  other  nations  that  any  collateral  damages 
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were  unintended  side  effects,  rather  than  brutish,  illegal  violence.  A  convincing  argument  backed  by  a 
policy  stated  a  priori  will  limit  escalation  of  a  crisis.  Finally,  such  a  policy  will  open  debate  with  the 

Russian  government,  whose  representatives  have  classified- CNA  as  a  form  of  WMD,  and  which  they 

39 

promise  to  answer  with  unspecified  WMD  countermeasures. 

Like  national  policy,  the  concepts  of  employment  must  clearly  rest  upon  the  principles  of  just  war 
theory.  Current  technology,  while  sophisticated,  must  not  constrain  these  concepts;  rather  the  concepts 
must  drive  research  and  development  to  meet  conceptual  needs.  Such  research  must  be  directed  toward 
bettering  intelligence  collection  capabilities  and,  importantly,  making  CNA  weapons  ever  more  precise 
and  discriminate.  While  CNA  may  someday  have  the  capability  for  stand-alone  employment,  that  day 
may  be  well  in  the  future,  therefore  operational  concepts  using  CNA  as  an  adjunct  or  supporting  capability 
are  in  order.  The  laws  of  warfare  still  apply,  however.  Even  in  the  context  of  supporting  a  psychological 
operation,  larger  information  campaign,  or  conventional  strike,  using  the  CNA  in  a  treacherous  or 
perfidious  manner  is  morally  wrong.  Joint  doctrine  must  make  the  considerations  of  jus  in  bello  clear  to 
planners  and  commanders  who  will  use  these  potentially  powerful  weapons. 

SUMMARY 

Just  as  the  increasing  dependence  upon  sea  trade  brought  pirates  and  navies  to  the  oceans, 
increasing  reliance  on  the  microchip  and  communications  networks  will  attract  criminals,  terrorists,  and 
the  military  interest  of  nations.  As  the  Royal  Navy’s  control  of  the  seas  drove  the  prosperity  and 
expansion  of  Great  Britain  in  earlier  centuries,  control  of  the  computer  dimension  holds  great  promise  for 
the  United  States.  The  U.S.  must  carefully  craft  its  policies  relating  to  this  new  dimension.  Such  policies 
will  determine  whether  it  becomes  a  lawless,  crime-ridden  highway  where  no  one  is  safe,  or  an  orderly 
and  productive  tool  of  economic  expansion.  These  policies  will  drive  our  development  of  capabilities  to 
police  this  dimension,  as  well  as  our  ability  to  defend  our  national  interests  there.  The  success  of  our 
policies  will  rest  to  a  large  measure  on  the  extent  to  which  they  incorporate  considerations  of  jus  in  bello. 

Word  count  =  5967 
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